Skip to content

Snapshots and data resiliency

This chart does not provision snapshot buckets, register repositories, or create Snapshot Lifecycle Management policies. Use Elastic’s ECK snapshot-repository guidance for the provider-specific procedure and restore compatibility.

Package integration

  • Provision storage, permissions, and Secrets separately. Package elasticsearch.secureSettings accepts Secret references in the workload namespace and applies them cluster-wide; SSO’s reference is prepended rather than replacing user references. Keep credential contents out of Git and logs.
  • If using workload identity, review the package-created Elasticsearch service account, umbrella serviceAccountAnnotations.elasticsearch mapping, token projection, and provider requirements. An annotation alone does not prove identity integration or bucket authorization.
  • Allow snapshot destinations in network policies and, when applicable, the mesh registry. Include CA trust for private object-store endpoints. See network policies and mesh security.
  • Upstream Elasticsearch bundles S3, GCS, and Azure repository support from 8.0. Do not install repository-s3 by default for this chart’s 9.x deployment. Verify the selected Iron Bank image before assuming any optional module/plugin is available. For an independently required customization, the package entry points are elasticsearch.common.initContainers or a node set’s initContainers, not a top-level initContainers key.

Validate snapshot creation and a representative restore in an authorized isolated environment before storage/topology changes. Choose snapshot contents, including security/Kibana feature state, according to the upstream restore procedure and your recovery objectives. A successful chart render, PVC, or green cluster is not backup evidence.

For example, these package values attach an already provisioned keystore Secret without exposing its contents:

elasticsearch:
  secureSettings:
    - secretName: elasticsearch-snapshot-credentials

Create the Secret in the workload namespace (logging in the default umbrella deployment) through the approved secret-management workflow. For S3’s default client, its keys are s3.client.default.access_key and s3.client.default.secret_key; other providers or named clients have different keys. Preserve every existing user Secret reference because this list replaces the user list; the chart still prepends the SSO Secret when SSO is enabled. This example does not provision a bucket, install a plugin, grant network access, register a snapshot repository, or schedule backups. Continue with the upstream provider-specific repository procedure and an isolated restore test.